this post was submitted on 21 Nov 2023
162 points (91.3% liked)

Technology

58061 readers
31 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 50 points 10 months ago (1 children)

This is tilting at windmills. If someone has physical possession of a piece of hardware, you should assume that it's been compromised down to the silicon, no matter what clever tricks they've tried to stymie hackers with. Also, the analog hole will always exist. Just generate a deepfake and then take a picture of it.

[–] [email protected] 41 points 10 months ago (12 children)

You have it backwards. This is not too stop fake photos, despite the awful headline. It's to attempt to provide a chain of custody and attestation. "I trust tom only takes real photos, and I can see this thing came from Tom"

[–] [email protected] 20 points 10 months ago (1 children)

And if the credentials get published to a suitable public timestamped database you can also say "we know this photo existed in this form at this specific time." One of the examples mentioned in the article is the situation where that hospital got blown up in Gaza and Israel posted video of Hamas launching rockets to try to prove that Hamas did it, and the lack of a reliable timestamp on the video made it somewhat useless. If the video had been taken with something that published certificates within minutes of making it that would have settled the question.

[–] [email protected] 10 points 10 months ago* (last edited 10 months ago) (3 children)

That doesn't really work. If the private key is leaked, you're left in a quandary of "Well who knew the private key at this timestamp?" and it becomes a guessing game.

Especially in the scenario you posit. Nation-state actors with deep pockets in the middle of a war will find ways to bend hardware to their will. Blindly trusting a record just because it's timestamped is foolish.

[–] [email protected] 8 points 10 months ago (1 children)

You’re right, it isn’t perfect so we shouldn’t bother trying. 🙄

[–] [email protected] 3 points 10 months ago (2 children)

In this case yes, because if it's not perfect, then it's perfectly useless

load more comments (2 replies)
[–] [email protected] 4 points 10 months ago (7 children)

If all that you're interested in is the timestamp then you don't even really need to have a signature at all - just the hash of the image is sufficient to prove when it was taken. The signature is only important if you care about trying to establish who took the picture, which in the case of this hospital explosion is not as important.

load more comments (7 replies)
[–] [email protected] 2 points 10 months ago (3 children)

Maybe each camera has a different public/private key?

load more comments (3 replies)
load more comments (11 replies)
[–] [email protected] 40 points 10 months ago* (last edited 10 months ago)

If only I knew how to create my own firmware for Leica... then I could call the same crypto-chip and sign any picture I'd like. (Oh wait! There's a github for hacking Leica M8 firmware!)

Source

[–] [email protected] 36 points 10 months ago (2 children)

Ah, DRM for your photos.

Great.

[–] [email protected] 43 points 10 months ago (6 children)

Not at all. From what I understand of this article, it wouldn't stop you from doing anything you wanted with the image. It just generates a signed certificate at the moment the picture is taken that authenticates that that particular image existed at that particular time. You can copy the image if you like.

load more comments (6 replies)
[–] [email protected] 7 points 10 months ago (1 children)

This isn't DRM. I can't believe you have so many upvotes for such blatant FUD.

load more comments (1 replies)
[–] [email protected] 34 points 10 months ago

I think this is probably great for specific forensic work and similar but the problem with deepfakes isn't that people can't determine their veracity. The problem is that people see a picture online and don't bother to even check. We have news sources that care about being accurate and trustworthy yet people just choose to ignore them and believe what they want.

[–] [email protected] 31 points 10 months ago (2 children)

"that it’s a true representation of what someone saw."

Someone please correct me if I'm wrong but photography has never ever ever been a "true" representation of what you took a picture of.

Photography is right up there with statistics in its potential for "true" information to be used to draw misleading or false conclusions. I predict that a picture with this technology may carry along with it the authority to impose a reality that's actually not true by pointing to this built-in encryption to say "see? the picture is real" when the deception was actually carried out by the framing or timing of the picture, as has been done often throughout history.

[–] [email protected] 9 points 10 months ago* (last edited 10 months ago) (6 children)

You're talking about "the whole truth". If the whole is true, then all of the parts are true, so photographing only a subset of the truth (framing) is still true. If a series of events are true, then each event is true, so taking a picture at a certain time (timing) is also true.

Photos capture real photons that were present at real scenes and turn them into grids of pixels. Real photographs are all "true". Photoshop and AI don't need photons and can generate pixels from nothing.

That's what is being said.

load more comments (6 replies)
[–] [email protected] 7 points 10 months ago (1 children)

As I understand it, it's a digital signature scheme where the raw image is signed at the camera, and modifications in compliant software are signed as well. So it's not so much "this picture is 100% real, no backsies". Nor is it "We know all the things done to this picture", as I doubt people who modify these photos want us to know what they are modifying.

So it's more like "This picture has been modified, like all pictures are, but we can prove how many times it was touched, and who touched it". They might even be able to prove when all that stuff happened.

[–] [email protected] 6 points 10 months ago

Even that doesn't do much to prove the image is an authentic representation of anything. People have been staging photos for as long as there have been photos, and no camera can guard against that.

[–] [email protected] 29 points 10 months ago (4 children)

So basically I would just have to screenshot the image or export it to a new file type that doesn't support their fancy encryption and then I can do whatever I want with the photo?

[–] [email protected] 21 points 10 months ago

The point is that they can show anybody interested the original with the signature from the camera.

The problem is that you can likely attack the camera's security chip to sign any photo, as internally the photo would come from the cmos without any signing and the camera would sign it before writing it to storage.

[–] [email protected] 9 points 10 months ago (2 children)

Just like stealing an NFT.

load more comments (2 replies)
[–] [email protected] 7 points 10 months ago

It's signed, not encrypted. Think of it as a chain of custody mark. The original photo was signed by person X, and then edited by news source Y. The validity of that chain can be verified, and the reliability judged based on that.

Effectively it ties the veracity and accuracy of the photo to a few given parties. E.g. a photo from a known good war photographer, edited under the "New Your Times" newspaper's licence would carry a lot more weight than a random unsigned photo found online, or one published by a random online rag print.

You can break the chain, but not fake the chain.

[–] [email protected] 5 points 10 months ago

I think you misunderstand what this does

It gives you a "certificate" that proofs that the Photo you took is genuine

It doesn't stop you from editing a Picture

[–] [email protected] 18 points 10 months ago

Everyone talking about hacking the firmware to extract the private key

Me just taking a photo of the deepfake

[–] [email protected] 17 points 10 months ago (1 children)
load more comments (1 replies)
[–] [email protected] 17 points 10 months ago (2 children)

Maybe I am misunderstanding here, but what is going to stop anyone from just editing the photo anyway? There will still be a valid certificate attached. You can change the metadata to match the cert details. So... ??

[–] [email protected] 11 points 10 months ago (1 children)

I don't know about this specific product but in general a digital signature is generated based on the content being signed, so any change to the content will make the signature invalid. It's the whole point of using a signature.

[–] [email protected] 3 points 10 months ago (1 children)

I was too tired to investigate further last night. That is the case here, sections of data are hashed and used to create the certs:

https://c2pa.org/specifications/specifications/1.3/specs/C2PA_Specification.html#_hard_bindings

Which means that there isn't a way to edit the photo and have the cert match, and also no way to compress or change the file encoding without invalidating the cert.

load more comments (1 replies)
[–] [email protected] 3 points 10 months ago

I'm not expert in encryption, but I think you could store a key in the device that encrypts the hash, then that encrypted hash is verified by Leica servers?

[–] [email protected] 16 points 10 months ago* (last edited 10 months ago) (1 children)

Ctrl + F "Blockchain"

... Oh?

Well that's a suprise, a system that actually is comperable to block chain in a different medium doesn't plaster it everywhere. We've certainly seen more use over much much less relevance.

Neat tech. Hope it catches on.

[–] [email protected] 8 points 10 months ago* (last edited 10 months ago)

And where do you see any resemblance to a blockchain?

From the article it is just cryptographic signing - once by the camera with its built-in key and once on changes by the CAI tool which has its own key.

[–] [email protected] 7 points 10 months ago

Informacam has a similar "chain of custody" goal but was developed for existing devices. Guardian Project was involved with CameraV, the android version for mobile devices. It looks like Proofmode is now the active project & it's available for ios as well as android. https://proofmode.org/

[–] [email protected] 4 points 10 months ago (1 children)
[–] [email protected] 25 points 10 months ago (1 children)
[–] [email protected] 5 points 10 months ago (1 children)

Yeah. In eurotrip a dork got a BJ just for owning a Leica.

[–] [email protected] 3 points 10 months ago (1 children)

You mean young Ben shapiro

[–] [email protected] 3 points 10 months ago (3 children)

I don't think that was him. https://m.imdb.com/name/nm5458588/

Also, WTF is he just cranking trash out?

[–] [email protected] 3 points 10 months ago

Not literally him lol, just looks like him. And yeah, you expect a grifter to make quality media?

[–] [email protected] 3 points 10 months ago

Alt-Right Bluey will always make me laugh.

What a pathetic person.

load more comments (1 replies)
[–] [email protected] 4 points 10 months ago (1 children)

I was wondering when crypto content would become a thing like this.

[–] [email protected] 3 points 10 months ago

It's one of the most obvious uses for it, I've suggested this sort of thing many times in threads where people demand "name one actually practical use for blockchains." Of course so many people have a fundamental hatred of all things blockchain at this point that it's probably best not to advertise it now. Just say what it can do for you and leave the details in the documentation for people to dig for if they really want to know.

load more comments
view more: next ›